Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa3f0496f16381a5…

MALICIOUS

PDF

47.6 KB Created: 2021-03-08 20:27:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 318662fd789ef489d3a1a4d810aef864 SHA-1: 373c5d718bfea945bcc42c5c56e837ca86b905bb SHA-256: fa3f0496f16381a52a469315247baeb84c5e4d5ed513254d6f6990aca11bfdc5
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7134

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=600+essential+words+for+the+toeic+pdf+mp3 PDF link annotation
    • http://winoorama.website/430147010461xe41.pdfIn PDF document text
    • https://pizipeko.weebly.com/uploads/1/3/4/6/134611096/zukojovom.pdfIn PDF document text
    • http://axecheat7.xyz/91825367301zh3kt.pdfIn PDF document text
    • http://wovuwukotuvoxi.mygamesonline.org/videkivu.pdfIn PDF document text
    • http://lnstagram-copyright-confirms.com/barajuluwo3497r.pdfIn PDF document text
    • https://gimuloge.weebly.com/uploads/1/3/0/7/130775506/vadenus_webevediki_rakuzewoxixetum.pdfIn PDF document text
    • http://wumiwuzigimo.mywebcommunity.org/how_to_write_letter_of_recommendation_for_internship.pdfIn PDF document text
    • http://minosijasif.mypressonline.com/kwikset_smartcode_916_programming_guide.pdfIn PDF document text
    • https://vabeliguteziji.weebly.com/uploads/1/3/1/3/131379360/supapulafawena-sitaxofoxuf-musuzomoreb-kobiju.pdfIn PDF document text
    • https://joguwezur.weebly.com/uploads/1/3/4/5/134500750/15fce98e8346.pdfIn PDF document text
    • http://xupulakikovuxo.mypressonline.com/46223512619.pdfIn PDF document text
    • http://siankaanmexico.com/5e_necromancer_wizard_guideku46c.pdfIn PDF document text
    • http://construt.site/gafavatuvukccp14.pdfIn PDF document text
    • http://tafugegajotu.mygamesonline.org/how_much_do_physical_therapists_make_monthly.pdfIn PDF document text
    • https://gupapuna.weebly.com/uploads/1/3/4/7/134726568/mijasikinogatatu.pdfIn PDF document text
    • https://c301b42c-deab-4116-afcd-a09dd0728425.filesusr.com/ugd/4bb894_ba7c9c246d2b4230b6608449f48d73ff.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fasomusogapovi/57590345169.pdfIn PDF document text
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_2f882c3f57354790a92b5b6515ae2a9e.pdf?index=trueIn PDF document text
    • https://ce55c564-0e79-48ac-bd91-a034cff8554b.filesusr.com/ugd/bd1fc0_cee00463aeab458887943e97988b9c25.pdf?index=trueIn PDF document text
    • http://tifavamifikas.myartsonline.com/5026824949.pdfIn PDF document text
    • http://fusozevukatamir.atwebpages.com/29910074499.pdfIn PDF document text
    • https://s3.amazonaws.com/ditiruz/jinja_vs_django_template.pdfIn PDF document text
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_e7501a4fd1944f518ddf00d1bd0e646f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zarusegibitumet/should_ought_to_must_exercises.pdfIn PDF document text
    • http://duvodix.myartsonline.com/can_you_take_the_written_driving_test_online_in_mississippi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.